Analyst Security Operations

eSec Forte Technologies; Gurugram District; In loco; INR 800.000 - 1.200.000; Tempo pieno

Vantaggi offerti da questo lavoro

Health insurance for employee and in-s

Professional security-certification Re

Annual learning and skill-development

Sponsored conference and training

Flexible work arrangements

Descrizione del lavoro

eSec Forte in Gurugram is seeking an Analyst Security Operations to support a 24x7 Managed SOC. You will monitor security events, triage incidents, and execute response playbooks to contain and recover from threats.

You will engage with Splunk, Microsoft Sentinel, Elastic SIEM, and EDR tools daily. The role requires hands-on security monitoring, threat hunting, and writing concise incident reports for clients.

Competenze

• 2–3 years of dedicated SOC experience.
• Hands-on Splunk alert triage, log analysis, and dashboards.
• Experience with EDR, firewalls, IDS/IPS, and vulnerability scanners.
• Bachelor's degree or higher.
• Ability to work onsite from Gurugram office.

Mansioni

• Monitor and analyze security events and alerts across multiple SIEM platforms.
• Perform initial triage and investigation of endpoint security incidents (EDR).
• Execute incident response playbooks focusing on containment and recovery.
• Conduct proactive threat hunting across network and endpoint telemetry.
• Contribute to SIEM/EDR/SOAR rule improvements and reduce false positives.
• Generate incident reports and communicate status and mitigation steps to clients.
• Participate in shift-based operations for continuous coverage.

Conoscenze

SOC experience

SIEM proficiency

Analytical problem-solving

Formazione

Graduate degree

Strumenti

Splunk

Microsoft Sentinel

Elastic SIEM

CrowdStrike

SentinelOne

Defender for Endpoint

Tenable Nessus

Firewalls / IDS-IPS

Descrizione del lavoro

Analyst Security Operations

About the Role

As an Analyst Security Operations, you will be a core contributor to our 24x7 Managed Security Operations Center (SOC), actively monitoring, triaging, and responding to security incidents for our diverse client base. This role involves continuous analysis of security events, executing incident response procedures, and contributing to threat detection and hunting efforts to strengthen client security postures. You will engage daily with a range of security technologies to safeguard critical assets.

Key Responsibilities

• Monitor and analyze security events and alerts from SIEM platforms, including Splunk, Microsoft Sentinel, and Elastic SIEM, to identify potential threats and anomalies.
• Perform initial triage and investigation of endpoint security incidents using EDR solutions such as CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint.
• Execute incident response playbooks for confirmed security incidents, focusing on containment, eradication, and recovery, while adhering to strict service level agreements.
• Conduct proactive threat hunting activities across network and endpoint telemetry to detect advanced persistent threats and emerging attack patterns not caught by automated detections.
• Contribute to the continuous improvement of SIEM correlation rules, EDR detection logic, and SOAR playbooks to enhance detection efficacy and reduce false positives.
• Generate comprehensive incident reports and provide clear, concise communication to managed service clients regarding incident status, analysis, and recommended mitigation steps.
• Participate in shift-based operations to ensure continuous security monitoring and incident response coverage.

Requirements

• 2-3 years of dedicated experience in a Security Operations Center (SOC) environment, actively involved in security monitoring and incident response.
• Demonstrated proficiency with SIEM platforms, specifically hands-on experience with Splunk for alert triage, log analysis, and dashboard creation.
• Solid understanding of common attack vectors, security vulnerabilities, and threat intelligence concepts.
• Experience with security tools and technologies such as EDR, firewalls, intrusion detection/prevention systems (IDS/IPS), and vulnerability scanners like Tenable (Nessus).
• Ability to analyze network traffic, system logs, and security events to identify malicious activity and determine root causes.
• Strong analytical and problem-solving skills, with a methodical approach to incident investigation.
• Any graduate degree.
• Ability to work onsite from our Gurugram office.

Nice-to-Have

• Advanced Splunk Search Processing Language (SPL) skills for complex data analysis and correlation.
• Experience with SOAR platforms for automating incident response workflows.
• Familiarity with cloud security concepts and security monitoring within AWS, Azure, or GCP environments.
• Scripting capabilities (e.g., Python, PowerShell) for automating tasks or developing custom tools.

Benefits

• Health insurance for the employee and dependents.
• Professional security-certification reimbursement, including certifications like GIAC Certified Incident Handler (GCIH) or CompTIA CySA+.
• Annual learning and skill-development allowance.
• Sponsored conference and training attendance opportunities.
• Flexible work arrangements.